Mobile devices such as cell phones and personal digital assistants (PDAs) can be attacked by exploits or viruses that are specifically adapted for the mobile environment. Exploits can take advantage of security vulnerabilities associated with a mobile device in order to execute malicious code or perform undesired actions on the device. Potentially, exploits can bypass permissions or policies set by the user, manufacturer, operating system, or mobile operator and give the attacker complete control of the device. Mobile viruses are typically spread by downloading infected programs or files. Some viruses only become active if the recipient chooses to accept the virus file and run it on the mobile device. Other viruses, when combined with exploits, are self-propagating worms that may not need user intervention in order to spread, potentially creating a very severe and widespread security problem.
Devices may be compromised by viruses and exploits over wide area networks, such as the Internet or a cellular network, and local wireless networks, such as Wi-Fi or Bluetooth. For example, some devices which are equipped with Bluetooth allow other nearby Bluetooth-enabled devices to transfer files or other data such as contact information. Bluetooth-enabled devices that are infected with viruses often search for nearby devices that are in “discoverable” mode. When an infected device discovers a target, it may send a virus disguised as a security update or another item designed to fool the target device's user into accepting the transfer and executing the virus. If a virus were to utilize an exploit instead of disguising itself in order to get a target user to accept the file transfer, a device which is in “discoverable” mode could become infected without the user being able to intervene.
In addition to being able to propagate viruses, exploits may be able to directly perform malicious actions on vulnerable devices. Such exploits may be used by attackers to steal information, charge money to the target device's phone bill, or prevent a device from functioning properly. Although vulnerabilities which take advantage of exploits may be fixed if the software vendor responsible for the vulnerability provides a patch or firmware upgrade, such fixes are often costly and time consuming to release and difficult for users or IT organizations to apply.
It is important that both individual users and IT organization be able to verify that their security protection is functioning properly and be aware of the security state of their devices so as to be able to remediate or investigate issues as early as possible. If a device or group of devices has a security problem or has recently been attacked, the user or administrator responsible may not immediately know because mobile devices and existing solutions may not continuously present security status information and attempt to push important events to users and administrators.
What is needed is a system and method for identifying, reporting, and preventing mobile security problems and for providing security information concerning the state of a mobile device or group of mobile devices to a user or administrator. The system and method should keep users or administrators continuously aware of security status, recent security-related events, and potential security threats without requiring them to repeatedly seek out security-related information.